How Do I Choose an Incident Response Retainer?
Key takeaways
- A written response time and a named on-call responder matter more than the number of people on the provider's team, because the first hour decides the outcome.
- The retainer must state what is included: hours, travel, after-hours, and the rate card for work billed outside it, because that is where the cost surprises come from.
- Ask for the response time in writing, and check that it is a commitment with a measurement, not an aspiration in a brochure.
- CERT-In reporting within six hours and a forensics capability need to be in scope, since most organisations cannot produce a compliant report on their own.
- Test the retainer with a call outside business hours, and judge how fast somebody answers, asks the right questions and knows your systems.
As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.
What should an incident response retainer actually include?
Seven things, all of which should be in writing. A stated answer time, ideally fifteen minutes for a live incident, and a separate one for a business-hours callback. A named on-call responder, and a second named responder, because people go on leave. A defined scope, listing included hours, the after-hours rate, the travel rate and the rate card for forensics work. A pre-agreed methodology, so the first call is not spent on process. A reporting capability, because CERT-In requires notification within six hours of noticing. A retainer review, usually quarterly, to update the plan with what changed in your estate. And an exit path, so you know how your data and credentials are handed back if you leave.
How do I compare two incident response providers fairly?
Compare the answers, not the brochures. Ask each of them the same three questions: who exactly answers the phone at 11 pm, in how many minutes, and what do they need from us in the first ten minutes. Then ask what they have done in a case like yours, without naming the client, and ask for the report format they deliver. Test the service with a non-emergency call and measure the response yourself, because a claimed fifteen minutes and a measured hour are very different products. Finally, price the whole shape of the engagement, because a cheap retainer with expensive day rates and a slow response is worse value than a higher one that arrives in ten minutes.
Is a retainer worth it for a small Indian business?
For most SMEs in India, a modest retainer plus a tested plan is the cheapest available insurance, and it is much cheaper than a single hour of a bespoke engagement during an incident. The alternative is paying full day rates when the clock is running and the attacker is inside, with no pre-agreed methodology, no known responder and no report format. A retainer does not remove the need for backups, an incident response plan and a named internal owner, because the provider will ask you for those and cannot do them for you. If the budget only covers one thing, a fixed-scope retainer with a real response time and a tested restore of your backups is the better buy.
What questions should I ask before signing a retainer?
Ten, and ask for them in writing. What is the answer time during business hours and outside them. Who is the named responder and what is the backup. How many hours are included and what happens when they run out. What is the day rate for work outside the retainer. Does the retainer include a CERT-In-aligned incident report and forensic imaging. Do you arrive on site in Kerala, and at what notice. How is client data and evidence handled, and where is it stored. Do you hold CERT-In empanelment, and in which categories. What is the exit and handover process. And can we test the response time once before the contract starts.
| Criterion | Ask for | Good sign |
|---|---|---|
| Response time | A written answer time, in and out of hours | A commitment in the contract, not a brochure line |
| Named responders | Who answers, and who backs them up | Two names, both reachable, with a real rota |
| Scope | Included hours, after-hours and out-of-retainer rates | A published rate card with no ambiguity |
| Reporting | CERT-In-aligned report within six hours | They show you the template |
| Forensics | Imaging, custody and analysis in scope | A laboratory and a documented custody process |
| Test | One live call to measure response yourself | Somebody answers, and asks about your estate |
What are the frequently asked questions?
Get a straight answer on this
Send us your current incident response plan and the systems you cannot trade without, and we will return a retainer scope with a stated response time for comparison.
Send us the details See pricing